Accounts & access

Reading a meet is public; changing one requires an account. Access is controlled by accounts and role grants.

Creating accounts

• The first admin is created with the user-admin CLI.
• After that, admins invite users from the app: minting an invite link (and emailing it, if email is configured). The invitee clicks the link and sets their own password.
• Admins can disable an account or revoke its sessions.

Roles and scope

Account administration is itself scoped — an admin can only manage accounts and grant roles within the part of the org they’re responsible for. Nobody can escalate beyond their own delegable subtree (e.g. a team-level admin can’t reset a site admin’s password).

How auth works

Sign-in issues a token; write endpoints require it. An expired session surfaces in the app as a prompt to sign in again. Every mutating write is additionally guarded by optimistic locking so two people editing the same thing can’t clobber each other silently.